v7 misunderstandings fixed

[ssproject1617.git] / report / report.tex

diff --git a/report/report.tex b/report/report.tex
index dd56316..c365b4e 100644 (file)
--- a/report/report.tex
+++ b/report/report.tex
@@ -1,50 +1,63 @@
 %&report
 \begin{document}
 \maketitleru[course={Software Security}]
+
+
+\tableofcontents
+
+
 \section{Organization}
 \input{organization.tex}
 
-\section{Verdict}
+\section{Our security analysis of the \CMS{}}
+
+  \subsection{General comments}
+
+  \begin{itemize}
+    \item
+      The \CMS{} comes equipped with an installer script, which is incredibly insecure, but which the author of the \CMS{} assumes the admin will remove after installation. If we regard this installer script as part of our subject matter, the analysis becomes incredibly simple, as it directly makes the \CMS{} vulnerable to server side code execution, \SQL{} injections, etc. Therefore, we regard the installer script as a special case, and we assume that it is indeed removed after installation. The analysis, then, treats the \CMS{} as it is after installation.
+
+    \item
+      A number of times in our analysis, the OWASP ASVS requirements will require certain overridable server settings or request/response headers to be correcty set. The \CMS{} is in principle able to set these parameters, for example by adding directives to an Apache \code{.htaccess} file, or explicitly setting certain \HTTP{} response headers. However, the \CMS{} does not do so, and therefore relies upon the server's default settings. In these cases, we consider the requirements failed, although one might contest this on the principle of separation of concerns.
+  \end{itemize}
+
 
-\subsection*{General comments}
+  \renewcommand\thesubsection{V\arabic{subsection}}
 
-\begin{itemize}
-  \item \TODO{} (Kelley) Server instellingen.
-  \item \TODO{} (Kelley) \code{installer.php} and server code execution.
-\end{itemize}
+  \subsection{Authentication}
+  \input{v2_authentication}
 
-\addtocounter{subsection}{1}
-\subsection{Authentication}
-\input{v2_authentication}
+  \subsection{Session Management}
+  \input{v3_session.tex}
 
-\subsection{Session Management}
-\input{v3_session.tex}
+  \subsection{Access Control}
+  \input{v4_access.tex}
 
-\subsection{Access Control}
-\input{v4_access.tex}
+  \subsection{Input Validation \& Output Encoding/Escaping}\label{sec:v6} 
+  \input{v5_input.tex}
 
-\subsection{Input Validation \& Output Encoding/Escaping}
-\input{v5_input.tex}
+  \addtocounter{subsection}{1}
 
-\addtocounter{subsection}{1}
+  \subsection{Cryptography at rest}
+  \input{v7_cryptography.tex}
 
-\subsection{Cryptography at rest}
-\input{v7_cryptography.tex}
+  \subsection{Error Handling \& logging}
+  \input{v8_error.tex}
 
-\subsection{Error Handling \& logging}
-\input{v8_error.tex}
+  \subsection{Data Protection}
+  \input{v9_data.tex}
 
-\subsection{Data Protection}
+  \addtocounter{subsection}{1}
+  \subsection{\HTTP{} Security}
+  \input{v11_httpsec.tex}
 
-\addtocounter{subsection}{2}
-\subsection{HTTP Security}
-\input{v11_httpsec.tex}
+  \renewcommand\thesubsection{\arabic{section}.\arabic{subsection}}
 
-\addtocounter{subsection}{4}
-\subsection{Files and Recourses}
 
+\section{Summary and short reflection on Fortify's analysis}
+\input{fortify.tex}
 
-\section{Reflection}
+\section{General reflection}
 \input{reflection.tex}
 
 \end{document}